KYC Policy

Know Your Customer (KYC) is a process by which InvestHaat verifies the identity of its users before allowing them to transact on the platform. KYC is required by law under the Prevention of Money Laundering Act, 2002 (PMLA) and applicable RBI and SEBI guidelines. It helps us: • Verify that users are who they say they are • Prevent fraud, identity theft, and money laundering • Comply with tax reporting obligations (TDS on investment returns) • Protect the startup ecosystem from bad actors

InvestHaat uses a tiered KYC system. Higher tiers unlock more platform capabilities and higher investment limits. See the tier breakdown above.

Level 2 KYC (required to invest): • Aadhaar Card (front and back) • PAN Card • Selfie (live capture via webcam or phone camera) • Digital consent for Aadhaar-based verification Level 3 KYC (for unlimited investment): • All Level 2 documents • Bank account number and IFSC code (for penny-drop verification) • Income declaration (self-certified or Form 16 / ITR) • Accredited investor declaration (for investments above ₹10L)

Step 1: You submit your documents through the secure KYC wizard in your profile setup. Step 2: Your Aadhaar and PAN are verified against UIDAI and Income Tax databases in real-time via our KYC API partners (DigiLocker / Karza / Signzy). Step 3: Automated verification typically completes within minutes. If automated checks fail, your submission enters a manual review queue. Step 4: Manual review takes 1–3 business days. You will be notified by email upon approval or if additional documents are needed. Step 5: Upon successful KYC, your account is upgraded and you receive the appropriate verification badge.

A key feature of InvestHaat is that KYC is tied to your user account, not to individual roles. If you complete KYC for your Investor role, the same verification applies automatically to your Founder role, Mentor role, and any other role you activate. You will never need to re-submit KYC documents for a second role on the same account.

All KYC documents are: • Encrypted at rest using AES-256 encryption • Transmitted over TLS 1.3 encrypted connections • Stored in Indian AWS regions (Mumbai / Hyderabad) only • Accessible only to authorized compliance personnel and our KYC API partners • Never shared with other users, startups, or third parties except as required by law • Retained for 5 years as required by PMLA, then securely deleted You have the right to request deletion of your KYC data when you close your account, subject to mandatory legal retention periods.

InvestHaat may require you to complete re-KYC if: • Your existing KYC documents have expired (Aadhaar and PAN do not expire, but address proofs may) • There is a material change in your financial profile • Regulatory requirements change • Suspicious activity is detected on your account You will receive advance notice of any re-KYC requirement.

Your KYC may be rejected if: • Documents are illegible, expired, or tampered • The name on documents does not match your registered name • The selfie does not match the Aadhaar photo • You are on a sanctions list or are a PEP with elevated risk If your KYC is rejected, you will receive an explanation and an opportunity to resubmit with correct documents. Repeated failures will result in a review by our compliance team.